\ Monge, Elaine (SCA) 


From: 

Sent: 

To: 

Subject: 

noreply@formstack.com 

Friday, March 23, 2018 4:50 PM 

Breaches, Data (SCA) 

Security Breach Notifications 

ED ■ == " 




Formstack Submission For: Security Breach Notifications 

Submitted at 03/23/1 8 4:50 PM ; 

Business Name: 

Squire Patton Boggs (US) LLP 

Business Address: 

4900 Key 'Power, 127 Public Square 

Cleveland, OH 44114 

Foreign Business Address: 


Company Type: 

Other 

Your Name: 

Stacy Baltin 

Titie: 

Partner and General Counsel 

Contact Address: 

Same as above 

Foreign Contact Address: 


Telephone Number: 

(216) 479-8500 

Extension: 

8523 

Email Address: 

stacy.ballin@squirepb.com 

Relationship to Org: 

Other 


i 




















Breach Type: 

Date Breach was Discovered: 

Number of Massachusetts 
Residents Affected: 

Person responsible for data 
breach.: 


Please give a detailed explanation 
of how the data breach occurred.: 


Please select the type of personal 
information that was included in 
the breached data.: 

Please check ALL of the boxes that 
apply to your breach.: 

For breaches involving paper: A 
lock or security mechanism was 
used to physically protect the 
data.: 

Physical access to systems 
containing personal information 
was restricted to authorized 
personnel only.: 

Network configuration of breached 
system: 


Paper 

01/31/2018 


9 


Current Employee 

Our law firm learned that in the course of mailing out annual 
Form 1099s, the hard copy of one individual’s Form 1099 
was mistakenly included in an envelope of another recipient’s 
Form 1099. The Form 1099s contain the Tax ID numbers of 
corporate payees, or the social security number of individual 
payees, along with name and mailing address and other 
information found in a Form 1099. The incident occurred at 
the end of January 2018, when our film’s accounting staff 
sent Form 1099s relating to ail vendors or other third parties 
we had paid during 2017 for whom Form 1099s are required. 
We learned of the incident on February 7, 2018, when a 
vendor who received two Form 1099s in their package alerted 
us to the issue involving a New Jersey resident. 


Social Security Numbers = Selection(s) 


The person(s) with possession of personal information had 
authorized access — Selection(s) 


N/A 



N/A 
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For breaches involving electronic 
systems, complete the following; 

All Massachusetts residents 
affected by the breads have been 
notified of the breach.: 


Mcthod(s) used to notify 
Massachusetts residents affected 
by the breach (check all that 
apply):: 

Date notices were first sent to 
Massachusetts residents 
(MM/DD/YYYY): 

All Massachusetts residents 
affected by the breach have been 
offered complimentary credit 
monitoring services 


Law enforcement has been notified 
of this data breach.: 


Please describe how your company 
responded to the breach. Include 
what changes were made or may 
be made to prevent another similar 
breach from occurring.: 


N/A = Sclection(s) 


Yes 


US Mail = Selection(s) 




03/12/2018 


Yes 


No 


We consulted with data privacy lawyers and a third party 
forensic vendor and took steps to identify as best we could 
who was affected by the error. We took prompt remedial 
steps, including proper instructions to employees in handling 
1099s. We will have enhanced oversight of staff for the future 
sending of 1099s. Finally, as an additional precaution, we 
arranged to have AllClear ID protect the identity of the 
potentially affected individuals for 12 months at no cost to 
them. The services include identity protection, identity repair, 
and credit monitoring. 


Copyright (Q 2018 Fomistack, LLC. All rights reserved. This is a customer service email. 
Forrnstack. 8604 Allisonvilie Road, Suite 300, Indianapolis, IN 46250 
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Monge. Elaine (SCA) 


From: 

Sent: 

To: 

Cc: 

Subject: 

Attachments: 


McKean, Amy L. <amy.mckean@squirepb.com> on behalf of Ballin, Stacy D. 
<stacy.ballin@squirepb.com> 

Friday, March 23, 2018 5:01 PM 
Breaches, Data (SCA) 

Ballin, Stacy D. 

Data Breach Notification Submission 

Data Breach Notification Submission.pdf; Consumer Notice.pdf 


Attached please find the Data Breach Notification Submission also submitted online as well as the Consumer 
Notice, as required. 


SQUIRES) 

PATTON BOGGS 


Stacy D. Ballin 
Partner and General Counsel 
Squire Patton Boggs (US) LLP 
4900 Key Tower 
127 Public Square 
Cleveland, Ohio 44114 
T +1 216 479 8523 
O +1 216 479 8500 
F +1 216 479 8780 
M +1 216 268 9462 


Stacv.Ballin@squirepb.com | squirepattonboggs.com 


47 Offices in 20 Countries 

This message is confidential and may be legally privileged or otherwise protected from disclosure. If you are 
not the intended recipient, please telephone or email the sender and delete this message and any attachment 
from your system; you must not copy or disclose the contents of this message or any attachment to any other 
person. 

Squire Patton Boggs (US) LLP is part of the international legal practice Squire Patton Boggs, which operates 
worldwide through a number of separate legal entities. Please visit www.squirepattonboggs.com for more 
information. 

#US 
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Mass.gov 


Data Breach Notification Submission 

Data Breach Notification Submission 


instructions: Please complete the form below to submi t a data breach notification to the 
Office of Consumer Affairs and Business Regulation. You can also print this submission for 
your own records. Please note under M.G.L. C83H, a se parate notification must be sent to the 
Attorney General's Office, 

If you're mailing your submission, please send to: Office of Consumer Affairs and Business 
Regulation, 501 Boylston St, Suite 5100, Boston, MA 02116 


Individual breaches affecting multiple debit/credit card holders of your organization 
can be reported on a monthly basis. 

Please do not include any personally identifiable information for Massachusetts 
residents in any of the fields. 


Section I: Organization & Contact 
Information 


Business Name* 


Squire Patton Boggs (US) LLP 


https://www.mass.gov/forms/data-breach-notification-submission 


3/23/2018 
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Business Address (optional) 

4900 Key Tower. 127 Public Square 

Cleveland 

Cry 

Ohio j vj 

Staff 

44114 

lip> 

Foreign Business Address (optional) 


ft (Mi if im-iat 11 ** 'uiini viitwh' Unfa'*} fh fr wi'in'w. h l ’>v 

Company Type * 

0,te 0 

Your Name* 

Stacy 

l-vial 'tern? 

Ballin 


https://www.mass.gov/forms/data-breach-notificalion-submission 


3/23/2018 
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Title * 

Partner and General Counsel 


Contact Address (optional) 
Same as above 





ifD 

TP Ox/p 

Foreign Contact Address (optional) 


It your earit<wf (kidt&is « outiirfe the Uruttui fc'v? addntsi h#ts 

Telephone Number'' 

(216) 479-8500 

Extension (optional) 

8523 


https://www.mass.gov/forms/data-breach-notification-submission 


3/23/2018 





Data Breach Notification Submission | Mass.gov 


Page 4 of9 


Email Address ’ 

sl:aey,ball i h@squ i rcpb.com 


Relationship to Org * 





Breach Type * 

Paper V | 


Date Breach was Discovered ' 

01 y 31 y 2o,a y 


Number of Massachusetts Residents Affected* 

9 


Person responsible for data breach. * 


Ctmeni Employee 



Please give a detailed explanation of how the data breach occurred. * 


https://vvww.mass.gov/fonns/data-breach-notification-submission 


3/23/2018 
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Our (gw firm learned that in the course of mailing out annual Form 1099s, the hswd copy of one indMdual's Foam 
1099 was mistakenly included in art envelope of another recipient's Form 1099, The Form 1099s contain the Tax 
ID numbers of corporate payees, or the social security number of individual payees, along with name and mailing 
address and other information found in a Form 1099, The incident occurred at the end of January 2018, .when our 
firm's accounting staff sent Forth 1099s relating to &N Vendors or other third parties we had paid during 2017 for 
whom Form 1099s are required, We learned of the incident on February 7,2018, when a vendor who received two 
Form 1099s in their package alerted us to tire issue involving a New Jersey resident. 


Please select the type of personal information that was included In the breached data/" 


Select fonts) 


Financial Account Numbers 


Social Security Numbers 


0 


D river 1 s Liconse 


□ 


Credit/Debit Card Number 


□ 


Please check ALL of the boxes that apply to your breach, * 

Selection^) 


The person(s) with possession of personal Information had 

nuihodfced access 


0 


The breach was a result of a malicious/c/imhtal a cl. 


□ 


The breach occurred while the data was being transported 
outside of your premises. 


□ 


The breach occurred at the location of a third party service 

provider. 


□ 


https://www.mass, gov/forms/data-breach-notili cation-submission 


3/23/2018 




Data Breach Notification Submission J Mass.gov 
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There is a written contract in place with the third-potty provider 
requiring protection of personal information. 


Section III: Security Environment 


For breaches involving paper: A lock or security mechanism was used to physically protect 
the data, * 


□ Yes 


□ No 

m n/a 


Physical access to systems containing personal information was restricted to authorized 
personnel only.* 

0 Yes 

□ No 

□ N/A 


Network configuration of breached system * 


N/A 



For breaches involving electronic systems, complete the following 4 


Selection^} 


Brtoctad data was encrypted. 


□ 


The key te encrypted data was stolen. 


https://www.niass.gov/forms/clata-breach-notification-submission 


3/23/2018 
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os 



2018 ! V 



All Massachusetts residents affected by the breach have been offered complimentary credit 
monitoring services .* 

0 Yes 

□ No 


Law enforcement has been notified of this data breach.* 
□ Yes 
0 No 


Please describe how your company responded to the breach. Include what changes were 
made or may be made to prevent another similar breach from occurring. * 

We consulted with data privacy lawyers and a third party forensic vendor and took steps to identify as best we 
could v/ho was affected By the error. We took prompt remedial steps, including proper instructions to employees 
in handling 1033s. We will isave enhanced oversight of staff for the future sending of 1099s. Finally, as an 
additional precaution, we arranged to have AHOear ID protect the identity of the potentially affected individuals for 
12 months- at no cost to them. The services include identity protection, identity repair, and credit monitoring. 


* Any documents pertaining to the data breach includingthe Setter being sent to the 
Massachusetts residents must be sent via email to data.breaches@5tate.ma.ys 

* Please do not include any personally identifiable information for Massachusetts 
residents in any email attachment. 

> individual breaches affecting multiple debit/credit card holders of your organization 
can be reported on a monthly basis. 

> Please review the information you have entered and click on the "Submit Form" button 
below. 


https://www, mass.gov/forins/dala-breacli-notification--submissi 0 n 


3/23/2018 
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https://www.mass.gov/fonns/data-breach-notifieation-submission 


3/23/2018 






SQUIRE© 

PATTON BOGGS 


Squire Patton Boggs (US) LLP 
1500 W. 3rd Street, Suite 450 
Cleveland, Ohio 44113 

O +1 216 687 3400 
F +1 216 687 3401 
squlrepattonboggs.com 


Michael E, McKenna 
T +1 216 687 3427 
michael,mckenna@squirepb.com 


[DATE] 

[NAME] 

[ADDRESS] 


Dear ____; 

We are writing to inform you of an incident that may have involved your personal information. It has 
come to our attention that in the course of maiiing out annual 1099s, a 1099 for one (1) individual 
recipient was mistakenly included in the envelope with another recipient’s 1099, We are not aware 
of any other instances where a 1099 recipient received another individual’s 1099. To ensure that 
all intended recipients have received 1099s, we have resent all individual 1099s. In addition, out of 
an abundance of caution, we are sending letters to all potentially affected individuals (i.e., all 
individuals who are 1099 recipients) to inform you about the incident and offer credit. 

To be clear, we have not learned that your 1099 was mistakenly mailed to another 
person. However, since we cannot determine whether paper copies of any other individuals’ 1099s 
were mistakenly included in another individual’s 1099 envelope, we are notifying all of our individual 
1099 recipients, which is why you are receiving this notice. 

If you received your 1099 from Squire Patton Boggs (SPB) by the first or second week of 
February, then your 1099 was not sent to another individual and this notice does not apply 
to you , If you did not receive your 1099 by the second week in February, it is possible another 
1099 recipient received your 1099 along with their own, however it also possible that something 
else happened, such as, it got lost in the mail, or was opened and misplaced by another person in 
your household. 

For the sake of clarity, no electronic 1099s (or any other electronic records) were affected in this 
incident. 

We want to make you aware of steps you may take to guard against identity theft or fraud. Please 
review the enclosed Information about identity Theft Protection, 

As an added precaution, we have arranged to have AHCiear ID protect your identity for 12 months 
at no cost to you. The following identity protection services start on the date of this notice and you 
can use them at any time during the next 12 months, 


47 Offices in 20 Countries 

Squlm Patton Boggs (US) LLP is pari of the international tega! practice Squire Fallen Boggs, which operates worldwide through a number of separate 
legal entities. 


Please visit squirepaltonboggs.corn for more information. 
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AtIClear Identity Repair: This service is automatically available to you with no enrollment required. 
If a problem arises, simply call 1-877-676-0379 and a dedicated investigator will help recover 
financial losses, restore your credit and make sure your identity is returned to its proper condition, 

AllClear Credit Monitoring: This service offers additional layers of protection including credit 
monitoring and a $1 million identity theft insurance policy. To use this service, you will need to 
provide your personal information to AllClear ID. You may sign up online at enroll,allclearid.com 
using the following redemption code: _. 

Please note; Additional steps may be required by you in order to activate your phone aierts and 
monitoring options. 

We take the protection of your personal information seriously and are taking steps to prevent a 
similar occurrence. 

If you have further questions or concerns about this incident, you contact Mike McKenna, Global 
Chief Financial Officer, Squire Patton Boggs at 216-687-3427. We sincerely regret any 
inconvenience or concern caused by this incident. 

Sincerely, 





Michael E, McKenna 
Global Chief Financial Officer 
Squire Patton Boggs (US) LLP 
1500 W. 3rd Street, Suite 450 
Cleveland, Ohio 44113 
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Information about identity Theft Protection 

We recommend that you regularly review statements from your accounts and periodically obtain your credit 
report from one or more of the national credit reporting companies, You may obtain a free copy of your credit 
report online at www.annualcreditreport.com, by calling toll-free 1-877-322-8228, or by mailing an Annual Credit 
Report Request Form (available atwww.annualcreditreport.com) to: Annual Credit Report Request Service, RO. 
Box 105281, Atlanta, GA, 30348-5281, You may also purchase a copy of your credit report by contacting one 
or more of the three national credit reporting agencies listed below. 

Equifax; P,0. Box 740241, Atlanta, Georgia 30374-0241, 1-800-685-1111, www.equifax.com 

Experian: P.O. Box 9532, Alien, TX 75013, 1-888-397-3742, www.experian.com 

Transition; P.O, Box 1000, Chester, PA 19022, 1-800-888-4213, www.transunion.com 

When you receive your credit reports, review them carefully. Look for accounts or creditor inquiries that you did 
not initiate or do not recognize. Look for information, such as home address and Social Security number, that is 
not accurate, if you see anything you do not understand, call the credit reporting agency at the telephone number 
on the report. 

We recommend you remain vigilant with respect to reviewing your account statements and credit reports, and 
promptly report any suspicious activity or suspected identity theft to us and to the proper law enforcement 
authorities, including local law enforcement, your state’s attorney general and/or the Federal Trade Commission 
("FTC"). You may contact the FTC or your state’s regulatory authority to obtain additional information about 
avoiding identity theft. 

Federal Trade Commission, Consumer Response Center 

600 Pennsylvania Avenue, NW, Washington, DC 20580, 1-877-IDTHEFT (438-4338), www.ftc.gov/idtheft 

For residents of Maryland; You may also obtain information about preventing and avoiding identity theft 
from the Maryland Office of the Attorney General: 

Maryland Office of the Attorney General, Consumer Protection Division 
200 St. Paul Piace, Baltimore, MD 21202,1-888-743-0023, www.oag.state.md.Us 

For residents of Massachusetts: You also have the right to obtain a police report. 

For residents of North Carolina: You may also obtain information about preventing and avoiding identity 
theft from the North Carolina Attorney General's Office: 

North Carolina Attorney General’s Office, Consumer Protection Division 
. 9001 Mail Service Center, Raleigh, NC 27699-9001,1-877-5-NO-SCAM, www.ncdoj.gov 

The next 2 paragraphs are regarding incidents involving personal health information. Disregard If not 
applicable to your situation. 

We recommend that you regularly review the explanation of benefits statement that you receive from your 
Insurer, if you see any service that you believe you did not receive, please contact your insurer at the number 
on the statement. If you do not receive regular explanation of benefits statements, contact your provider and 
request them to send such statements following the provision of services in your name or number. 

You may wantjo order copies of your credit reports and check for any medical bills that you do not recognize. If 
you find anything suspicious, call the credit reporting agency at the phone number on the report. Keep a copy of 
this notice for your records In case of future problems with your medical records. You may also want to request 
a copy of your medical records from your provider, to serve as a baseline. If you are a California resident, we 
suggest that you visit the web site of the California Office of Privacy Protection at www.privacy.ca.gov to find 
more information about your medical privacy. 

Fraud Alerts: There are also two types of fraud alerts that you can piace on your credit report to put your 
creditors on notice that you may be a victim of fraud: an initial alert and an extended alert. You may ask that an 
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Initial fraud alert be placed on your credit report if you suspect you have been, or are about to be, a victim of 
identity theft. An initial fraud alert stays on your credit report for at least 90 days. You may have an extended 
alert placed on your credit report if you have already been a victim of identity theft with the appropriate 
documentary proof. An extended fraud alert stays on your credit report for seven years. You can place a fraud 
alert on your credit report by calling the toll-free fraud number of any of the three national credit reporting 
agencies listed below. 

Equifax: 1-888-766-0008, www.equifax.com 

Experlan: 1-888-397-3742, www.experian.com 

TransUnion: 1-800-680-7289, fraud.transunion.com 

Credit Freezes (for Non-Massachusetts Residents): You may have the right to put a credit freeze, also known 
as a security freeze, on your credit file, so that no new credit can be opened in your name without the use of a 
PIN number that is issued to you when you initiate a freeze. A credit freeze is designed to prevent potential 
credit grantors from accessing your credit report without your consent. If you place a credit freeze, potential 
creditors and other third parties will not be able to get access to your credit report unless you temporarily lift the 
freeze. Therefore, using a credit freeze may delay your ability to obtain credit. In addition, you may incur fees 
to place, lift and/or remove a credit freeze. Credit freeze laws vary from state to state. The cost of placing, 
temporarily lifting, and removing a credit freeze also varies by state, generally $5 to $20 per action at each credit 
reporting company. Unlike a fraud alert, you must separately place a credit freeze on your credit file at each 
credit reporting company. Since the instructions for how to establish a credit freeze differ from state to state, 
please contact the three major credit reporting companies as specified below to find out more information: 

Equifax: P,0, Box 105788, Atlanta, GA 30348, www.equifax.com 

Experian: P.O. Box 9554, Allen, IX 75013, www.experian.com 

TransUnion LLC: P.O. Box 2000, Chester, PA, 19022-2000, freeze.transunion.com 

You can obtain more information about fraud alerts and credit freezes by contacting the FTC or one of the 
national credit reporting agencies listed above. 

Credit Freezes (for Massachusetts Residents): Massachusetts law gives you the right to place a security 
freeze on your consumer reports, A security freeze is designed to prevent credit, loans and services from being 
approved in your name without your consent. Using a security freeze, however, may delay your ability to obtain 
credit. You may request that a freeze be placed on your credit report by sending a request to a credit reporting 
agency by certified mail, overnight mail or regular stamped mail to the address below: 

Equifax: P.O. Box 105788, Atlanta, GA 30348, www.equifax.com 

Experian: P.O. Box 9554, Allen, TX 75013, www.experian.com 

TransUnion LLC: P.O. Box 2000, Chester, PA, 19022-2000, freeze.transunion.com 

Unlike a fraud alert, you must separately place a credit freeze on your credit file at each credit reporting company. 
The following information should be included when requesting a security freeze (documentation for you and your 
spouse must be submitted when freezing a spouse's credit report): full name, with middle initial and any suffixes; 
Social Security number; date of birth (month, day and year); current address and previous addresses for the 
past five (5) years; and applicable fee (if any) or incident report or complaint with a law enforcement agency or 
the Department of Motor Vehicles. The request should also include a copy of a government-issued identification 
card, such as a driver's license, state or military ID card, and a copy of a utility bill, bank or insurance statement. 
Each copy should be legible, display your name and current mailing address, and the date of issue (statement 
dates must be recent). The credit reporting company may charge a reasonable fee of up to $5 to place a freeze 
or lift or remove a freeze, unless you are a victim of identity theft or the spouse of a victim of identity theft, and 
have submitted a valid police report relating to the identity theft to the credit reporting company. 
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AUCiear Identity Repair Terms of Use 

If you become a victim of fraud using your personal information without authorization, AUCiear ID will help recover your financial 
losses and restore your identity. Benefits include: 

* «Time» months of coverage with no enrollment required. 

» No cost to you — ever. AUCiear Identity Repair is paid for by the participating Company. 

Services Provided 

If you suspect identity theft, simply call AUCiear ID to file a claim. AUCiear ID will provide appropriate and necessary 
remediation services {'Services") to help restore the compromised accounts and your identity to the state prior to the incident 
of fraud. Services are determined at the sole discretion of AilClear ID and are subject to the terms and conditions found on 
the AUCiear ID website. AUCiear Identity Repair Is not an insurance policy, and AilCiear ID will not make payments or 
reimbursements to you tor any financial loss, liabilities or expenses you incur. 

Coverage Period 

Service is automatically available to you with no enrollment required for «Time» months from the date of the breach incident 
notification you received from Company (the 'Coverage Period"), Fraud Events (each, an “Event") that were discovered prior 
to your Coverage Period are not covered by AUCiear identity Repair services, 

Eligibility Requirements 

To be eligible for Services under AUCiear Identity Repair coverage, you must fully comply, without limitations, with your 
obligations under the terms herein, you must be a citizen or legal resident eighteen (18) years of age or older, and have a 
valid U.S. Social Security number. Minors under eighteen (18) years of age may be eligible, but must be sponsored by a 
parent or guardian. The Services cover only you and your personal financial and medical accounts that are directly associated 
with your valid U.S, Social Security number, including but not limited to credit card, bank, or other financial accounts and/or 
medical accounts, 

How to File a Claim 

If you become a victim of fraud covered by the AUCiear Identity Repair services, you must: 

* Notify AUCiear ID by calling 1,855.434,8077 to report (he fraud prior to expiration of your Coverage Period; 

* Provide proof of eligibility for AUCiear Identity Repair by providing the redemption code on the notification Setter you 
received from the sponsor Company; 

* Fully cooperate and be truthful with AilClear ID about the Event and agree to execute any documents AliClear ID 
may reasonably require; and 

* Fully cooperate with AilClear 10 in any remediation process, including, but not limited to, providing AUCiear iD with 
copies of all available investigation files or reports from any institution, including, but not limited to, credit institutions 
or law enforcement agencies, relating to the alleged theft. 

Coverage under AUCiear Identity Repair Does Not Apply to the Following: 

Any expense, damage or loss: 

* Due to 

o Any transactions on your financial accounts made by authorized users, even if acting without your knowledge, 
or 

o Any act of theft, deceit, collusion, dishonesty or criminal act by you or any person acting in concert with you, or 
by any of your authorized representatives, whether acting alone or in collusion with you or others (collectively, 
your "Misrepresentation"); 

* Incurred by you from an Event that did not occur during your coverage period; or 

» In connection with an Event that you fail to report to AilCiear ID prior to the expiration of your AliClear Identity Repair 

coverage period, 

Other Exclusions: 

* AilClear ID will not pay or be obligated for any costs or expenses other than as described herein, including without 
limitation fees of any service providers not retained by AliClear ID; AilCiear iD reserves the right 1o investigate any 
asserted claim to determine its validity. 

* AliClear ID is not an insurance company, and AliClear Identity Repair is not an insurance policy; AilClear ID will not 
make payments or reimbursements to you for any loss or liability you may incur. 

« AiiCtear ID is not a credit repair organization, is not a credit counseling service, and does not promise to help you 
improve your credit history or rating beyond resolving incidents of fraud. 

* AilClear ID reserves the right to reasonably investigate any asserted claim to determine its validity. All recipients of 
AilClear identity Repair coverage are expected to protect their personal information in a reasonable way af all limes. 
Accordingly, recipients will not deliberately or recklessly disclose or publish their Social Security number or any other 
personal information to those who would reasonably be expected to improperly use or disclose that Personal 
information. 
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Opt-out Policy 

If for any reason you wish to have your information removed from (he eligibility database for AiiClear Identity Repair, piease 
contact AiiClear ID: 








